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STS-114: Engine Cut-Off Sensors Are a No-Go 


Overview 

Returning to Flight 

As the first Return to Flight Space Shuttle mission since the loss of Shuttle Columbia and its crew in 
2003, Space Shuttle Discovery was scheduled to launch on July 13, 2005, bound for a 13-day mission. 
Designated as STS-1 14, the mission would be Discovery’s 31 st flight and the 1 14 th flight of the Space 
Shuttle program. Anticipation was high as STS-114 was originally scheduled to launch in March of 
2003. NASA had taken 18 months to restructure its inspection and repair procedures to return the shuttle 
safely to flight. On July 13, 2005, STS-1 14 was finally ready to launch - well almost. Discovery’s crew 
of seven astronauts including mission commander Eileen Collins, pilot James Kelly, and mission 
specialists Soichi Noguchi 1 , Stephen Robinson, Andrew Thomas, Wendy Lawrence, and Charles 
Camarda were suiting up to board. The rocket was being prepared for fueling and the routine prelaunch 
checks were underway. However, during the launch countdown a liquid hydrogen tank low-level fuel 
cut-off sensor failed, and with it so did NASA’s first attempt to return to flight. 

Liquid-Hydrogen Cut-off Sensors 

Twenty-four propellant level sensors are within the shuttle’s external tank (ET) - twelve in the oxygen 
section and twelve in the hydrogen section. Of the dozen sensors in the hydrogen section, four are used to 
measure the amount of residual propellant present in the tank during ascent. These four sensors are 
known as engine cutoff, or ECO, sensors. Mounted on a single, shock-isolated carrier plate approximately 
four feet from the very bottom of the liquid hydrogen (LH 2 ) fuel tank, they are part of a backup system 
designed to protect the space shuttle main engines (SSMEs) from catastrophic failure due to propellant 
depletion [9]. The ECO sensors consist of a platinum wire sensing element mounted on an alumina 
printed wiring board (PWB) and encased in an aluminum housing [12, p.8]. Other components of the 
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level sensing system include harnesses, a series of 
connectors, and point sensor box (PSB) electronics in the 
orbiter. The voltage across the sensors in the tank is 
measured through wires by the PSB in the orbiter, which in 
turn sends data signals to the orbiter’ s onboard computer 
system. The sensor wires lead to a feed-through connector in 
the lower tank wall and are routed through other ET factory 
connectors. External cables run up the external tank vertical 
strut to the orbiter interface at the two orbiter/ET electrical 
monoball connectors [7, p.2]. The circuit is then routed 
inside the orbiter to the avionics bay where the PSB services 
the signal from the LH 2 ECO sensors. 

The PSB services all twenty-four level sensors within the 
external tank, including the four engine cutoff sensors within the LH 2 section. Mounted on a coldplate in 
avionics bay-5 of the orbiter, the PSB supplies each sensor circuit with a constant current and reads the 
voltage across each sensor’s thermosensor wire element [7, p.3]. The platinum wire sensing element of 
the sensor acts as a variable resistance which changes on exposure to cryogenic liquid [12, p.9]. At 
ambient temperature, when the sensor wire resistance is high, the measured voltage is considered above 
the preset trip level in the box and provides a “dry” indication. At liquid hydrogen temperature, -423°F, 
the voltage drops below the trip level and the signal is perceived as “wet”. Flight software checks for the 
presence of “wet” indications from the sensors to indicate the presence of propellant and “dry” indications 
to indicate the engines are at risk of running too low. The LH 2 ECO sensors are coded to read “wet” once 
propellant loading begins to mean they are covered with cryogenic propellant [9]. Should the PSB 
electronics fail to provide an output signal or if an open circuit develops between the PSB and the sensor, 
a “wet” state is also indicated. Therefore, the box design includes self-check electronics which are 
activated by ground simulation commanding to help distinguish between a “wet” sensor output and a 
failed “wet” output [7, p.3]. 



Fig . /. Engine cut-off sensors located at bottom 
of external tank [2]. 
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Fig. 4. Liquid hydrogen ECO sensors installed at bottom of external tank [7] 


Responsible for protecting the Shuttle’s main engines by triggering their shutdown in the event fuel runs 
unexpectedly low, the ECO sensor system is quite essential to proper Shuttle function. If a low level of 
liquid hydrogen were to occur in the 15-story fuel tank due to the main engines using more liquid 
hydrogen than predicted, it is crucial that the sensory system detects the condition immediately. The use 
of four sensors helps to ensure that multiple sensors agree that the tank is either empty, or not. The first 
“dry” indication from any of the ECO sensors is discarded to protect against a faulty sensor, but the 
subsequent presence of at least two more “dry” indications will result in a command to shutdown the 
SSMEs [12, p.9]. Once at least two of the three “active” sensors agree that the liquid hydrogen level is 
low, the main engines then shut down. 

A premature engine shutdown could prevent a crew from reaching orbit. The orbital maneuvering system 
engines do not have the ability to make up for early main engine cutoff. Additionally, a delayed 
shutdown could be extreme, especially if liquid oxygen alone flowed through the engines. In the absence 
of a proper mixture, the main engines’ turbo pumps would spin at an ever-increasing rate leading to 
engine fire or explosion and catastrophic destruction of the engines, the shuttle, and its crew. 

Since the Challenger disaster of 1986, NASA’s Launch Commit Criteria (LCC) has required four-of-four 
operational ECO sensors for a countdown to proceed. None of the four sensors can indicate “dry” prior to 
liftoff. Thus, when an ECO sensor anomaly occurred on the morning of July 13, the first attempt for an 
STS-1 14 launch was scrubbed and an investigation into possible causes was initiated immediately. 
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Challenges 

Pre-Launch 

Challenges with ECO sensors occurred as early as 
April 2005 during preparation for STS-1 14. Two 
sensors, ECO-3 and -4, operated intermittently 
during a tanking test. ECO-4 failed to indicate 
“wet” while fully loaded with propellants and 
ECO-3 failed to indicate “dry” up to ninety 
minutes after the tank was fully drained. To 
correct the issue, NASA engineers performed 
checkout of all hardware associated with the 
original failure, including the PSB. Once the PSB 
was confirmed to be operational, engineers were 
unable to trace the root cause of the performance 
error. It was decided to replace the PSB with the 
controller from Shuttle Atlantis and conduct a 
second tanking test. PSB serial number 108 was 
removed as suspect from Shuttle Discovery and 
replaced with serial number 110 [7, p.4]. The 
monoball harness was also removed and replaced. 
With these replacements, a second tanking test 
was performed in May 2005 during which the 
sensors worked normally. No ECO anomalies 
were observed during cryogenic loading. The fact 
that the original external tank, ET-120, was 
retested successfully during this second loading 
seemed to indict the removed PSB 108 and the 



Fig. 5. NASA test engineer Lloyd Pierce checks electronic 
components related to the faulty sensor readings in the LH 2 
tank low-level fuel cut-off sensor [5]. 



original monoball harness [7, p.4], Fig 6 Jack CoMla with Uniled Space AUjance conducts 

electromagnetic interference and ground resistance testing on 
Later testing led to the replacement of Discovery’s wiring in the aft engine compartment on Space Shuttle 

external tank and a second replacement of its PSB Discovery [6], 

due to unrelated issues. So at the time of the July 

13, 2005 launch. Shuttle Discovery was equipped with a new controller, replacement cabling, and a new 
ET. It was presumed that all of the proper steps to fix the issue had been taken. But during the official 
launch countdown, the LH 2 ECO-4 sensor still failed to transition from “wet” to “dry” when signaled 
during a computer simulation. During de-tank, the same sensor failed to transition to “dry” when the 
propellant level within the tank dropped below the sensor, but did transition several minutes later [12, 
p.10]. After de-tank, ECO-2, which had not experienced any trouble before, failed to transition from 
“wet” to “dry” during a “dry-when-wet” command. This sensor remained “wet” until about three hours 
into de-tank boil-off when it transitioned to “dry” [12, p. 10]. NASA officials became concerned that once 
the sensors were armed in flight, they could fail to cutoff the SSMEs in a fuel depletion situation. Thus, 
the ECO sensor issue remained to be an unexplained anomaly by NASA managers and the launch was 
scrubbed. 
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Preparing for 2 mi Launch Attempt 

To prepare Shuttle Discovery for a 2 nd launch attempt, several measures were taken to understand the 
ECO sensor system anomaly and to recreate the anomalous system behavior. Engineers tried to isolate 
different areas to determine which area failed. To start, the entire electrical path from the orbiter PSB and 
through the sensors was verified via resistance checks and time domain reflectometry [7, p.5]. Additional 
troubleshooting included subjecting components to thermal and vibration testing to levels above those 
seen on the vehicle during flight. Various loading conditions, including coldplate settings, purge 
flowrates, and electrical switching, were duplicated on the STS-1 14 integrated stack [7, p.5]. However, 
the cryogenic propellant liquid hydrogen was unable to be loaded. Retired NASA official Robert Kichak 2 
recalls, “Manufacturer acceptance testing of the ECO sensors was performed in liquid nitrogen, and this 
had at the time been believed to be adequate. Liquid hydrogen testing is much more difficult to perform, 
since it is hazardous,” [3]. Thus, the Space Shuttle Program did not test ECO sensors prior to launch 
countdown in liquid hydrogen at -423°F, but rather in liquid nitrogen at -320°F [12, p.12]. Additionally, 
NASA engineers were constrained by the limited number of cycles on the tank. As Mark Nappi 3 also 
noted, “You can’t just continue to tank [test] looking for a problem. It’s expensive and may cause the tank 
to not be used anymore,” [8]. So without the exact recreation of launch configuration, troubleshooting 
was impaired. 

Over the next few weeks, NASA engineers 
continued to find it difficult to pinpoint the 
source of the error. The point sensor box was 
eventually torn completely apart, but none of the 
discrepancies could be traced to either of the 
original failures. It only occurred when the 
vehicle was fueled and ready for launch. 

Swapping ECO sensors between two PSB signal 
conditioner channels was presented as a possible 
solution to facilitate troubleshooting, but was 
constrained by a programmatic requirement to 
maintain the vehicle in a launch-ready 
configuration [12, p.l 1]. Troubleshooting of the 
anomaly was extensive, but the root cause of the 
failures observed during STS-1 14’s first attempt 
to launch was not identified. Even NASA’s 
Engineering and Safety Center (NESC) 
consultation team, whose support was requested 
shortly following the initial anomaly, had limited findings and observations. While no definite cause 
could be pinpointed after weeks of investigation, probable causes included loss of continuity within both 
the ECO-3 and ECO-4 sensors’ circuitry which manifested as a result of thermal effects. These thermal 
effects may have been induced by either exposure of associated hardware to cryogenic temperatures or 



Fig. 7. Members of the engineering team are meeting in the 
Launch Control Center to review data and possible 
troubleshooting plans for the liquid hydrogen tank low-level 
fuel cutoff sensor [4]. 


2 Served as the National Engineering and Safety Center (NESC) Discipline Engineer for Avionics; co-author of * 4 STS-1 14 Engine 
Cut-off Sensor Anomaly Technical Consultation Report" 

3 Former United Space Alliance Vice President of Launch and Recovery Systems 
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heating effects within the PSB resulting from the increased steady state circuit current experienced when 
ET sensors are submersed in cryogenic liquid [10, p.30]. 

Decision Time 

Following the July 13, 2005 STS-1 14 initial launch attempt, NASA’s Mission Management Team (MMT) 
was faced with some very tough decisions. With inconclusive results from weeks of investigation, were 
they to proceed with launch? If the sensors failed again during countdown, were they to override the 
LCC? In the history of the Space Shuttle Program, the LH 2 ECO system had never initiated an engine 
shut down. Ascent performance margin and fuel bias provided additional protection against premature 
fuel depletion [9]. However, since the Challenger disaster in 1986, NASA’s Launch Commit Criteria 
required four of four functioning sensors to launch. Space Shuttle Management could override these 
qualifications with reasonable justification, but since the beginning of the Shuttle Program in 1981, no 
Shuttle had ever lifted off without a fully functioning ECO system. 

Proceeding with launch would have other implications as well. NASA engineers and its contractors would 
never be able to investigate the external tank flown in this mission again. Unlike the solid rocket 
boosters, the external tank and its elements, including the liquid hydrogen engine cut-off sensors, are not 
recovered and re-used. The ET is separated from the Space Shuttle after main engine cut-off and 
disintegrated upon reentry into the earth’s atmosphere. Each tank used for a Shuttle mission is a new 
tank. Therefore, NASA engineers are never able to investigate ET system anomalies post-mission. As 
Mark Nappi noted, ik The problem might be tank specific where the condition exists on one tank and it 
doesn’t exist on another tank. So you could continue tanking [testing] a tank that will never fail. And of 
course you don’t get the tank back so you can never do forensics on the hardware after the mission,” [8]. 
The ET cannot be physically disassembled and studied after it is flown. The mission could proceed and 
the team could never know what the real issue ever was, especially if it never reoccurred. 
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